CVE-2021-42171
HIGHZenario < 9.0.55143 - Unauthenticated Remote Code Execution via File Upload
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2021-42171. PoCs published by minhnq22.
AI-analyzed exploit summary This exploit demonstrates an authenticated RCE vulnerability in Zenario CMS 9.0.54156 by uploading a malicious DOCX file containing embedded PHP code. The exploit first authenticates to the CMS, then leverages the document upload functionality to achieve remote code execution.
Description
Zenario CMS 9.0.54156 is vulnerable to File Upload. The web server can be compromised by uploading and executing a web-shell which can run commands, browse system files, browse local resources, attack other servers, and exploit the local vulnerabilities, and so forth.
Exploits (2)
This exploit demonstrates an authenticated RCE vulnerability in Zenario CMS 9.0.54156 by uploading a malicious DOCX file containing embedded PHP code. The exploit first authenticates to the CMS, then leverages the document upload functionality to achieve remote code execution.
This exploit demonstrates an authenticated file upload vulnerability in Zenario CMS 9.0.54156, leading to remote code execution via a malicious DOCX file upload. The PoC includes authentication, session handling, and payload delivery.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H